how does aem prevents sql injection? | Community
Skip to main content
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by BrianKasingli

You should be fine, using JCR_SQL2 is read only which means that you can only use the "SELECT" keyword.

5 replies

Bhuwan_B
Community Advisor
Bhuwan_BCommunity Advisor
Community Advisor
April 27, 2022

@shikhasoni1 Please refer to below Community URL to get understanding of AEM Security Best Practices:

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/aem-security-best-practices-awakening-to-the-need-for-better/td-p/449600

    Anish-Sinha
    Adobe Employee
    Anish-SinhaAdobe Employee
    Adobe Employee
    April 27, 2022

    refer this for the techniques to prevent sql injections - https://labs.tadigital.com/index.php/2018/11/05/sql-injections-overview-and-prevention-techniques/

      arunpatidar
      Community Advisor
      arunpatidarCommunity Advisor
      Community Advisor
      April 27, 2022

      Please note that JCR SQL injections != RDBMS SQL injections. SQL in JCR is strictly read-only. As far as it is possible to manipulate a query the only risk is information leakage. No data can be manipulated as is the case with RDBMSes.

       

      Arun Patidar
        sourcedcode
        sourcedcode
        Level 2
        April 28, 2022

        .

          BrianKasingli
          Community Advisor and Adobe Champion
          BrianKasingliCommunity Advisor and Adobe ChampionAccepted solution
          Community Advisor and Adobe Champion
          April 28, 2022

          You should be fine, using JCR_SQL2 is read only which means that you can only use the "SELECT" keyword.

            maryani
            maryani
            Level 2
            March 27, 2023

            Hi 

            How can we prevent blind XPath injection for an AEM page??

             

            Thanks

             

              K
              KiranVe1
              April 5, 2024

              I have got a similar vulnerbility in our latest report. Did you find any solution for this?

                Terms & ConditionsAccessibility statement

                Loading footer...